Re: help: personalize introduction of authentication information

[email protected] (Lin Zhemin) Thu, 18 May 2000 03:11:40 +0800
Newsgroups	php.general
Message-ID	<[email protected]>
Buenos dias, Andres!

Sure it's possible. You may find (I forgot where, just search)
in the Net some file called "auth.php3" and read it.

I've already written a piece that works with cookie (if you
remember, a cookie is automatically read as an environmental
variable).

Since this file doesn't use HTTP realm (unlike other auth.php
you may find in the Net), you should include it after <body> tag.
You have to include it in every file you need to protect and
remove the .htaccess file. And you need to pass two env to it
using a form like this:

<form action="file_protected.php" method="post">
Name: <input type="text" name="user">
Password: <input type="password" name="pass">
</form>

Here's it:

<?
  function showfailed() {
    echo "Unauthorised.<br>"
    include("some_common_copyright_or_other_things.html");
    exit;
  }

if(empty($user)) $user = $PHP_AUTH_USER;
if(empty($pass)) $pass = $PHP_AUTH_PW;

if(empty($user) || empty($pass)) {
  showfailed();
} else {
  $link = mylink() or die("Database error");
  $str = "select pw from userlist where id='$user'" ;
  $result = mysql_query($str, $link) ;
  if(mysql_affected_rows($link) == 0)  showfailed() ;
  list($pass1) = mysql_fetch_row($result) ;
  $str = "select password('$pass')" ;
  $result = mysql_query($str, $link) ;
  list($pass2) = mysql_fetch_row($result) ;
  if(strcmp($pass1, $pass2)) {
    showfailed() ;
  }
  echo "<script language=\"JavaScript\">\n";
  echo "document.cookie = \"PHP_AUTH_USER=\" + escape('$user') + " .
       ";path=/\n";
  echo "document.cookie = \"PHP_AUTH_PW=\" + escape('$pass') + " .
       ";path=/\n";
  echo "</sciprt>\n";
}
    
N.B. password is stored in table userlist and is encrypted by MySQL
     password() function. Surely you may modify them according to your
     working environment.

> I'm using Apache server 1.3.12 with php-3.0.15 as an apache
> module and I would like to avoid the authentication window
> that shows client navigator when accesing a .htaccess
> protected web directory, because I want to personalize the
> environment in which users introduce their authentication
> information. There is a way to supply authentication
> information to apache server via a HTML form? Using PHP, it
> is possible to set $REMOTE_USER by setting $PHP_AUTH_USER y
> $PHP_AUTH_PW, but this requires the authentication window of
> client navigator because the putenv() function of php does
> not work with this variables (or I don't know how to make
> that it works with them). I'm trying the impossible?
> 
> Zanx.
> 
> Andrés
> [email protected]
> [email protected]

-- 

¥Í¦º«´Áï¡A»P¤l¦¨»¡¡F°õ¤l¤§¤â¡A»P¤l°º¦Ñ¡C
Fingerprint20 = CE32 D237 02C0 FE31 FEA9  B858 DE8F AE2D D810 F2D9